Splunk Search

Get the field name for a given value out of an event?

Path Finder

Hi,

let's say we have an event with the following information:

"Network Information:
Client Address: ee:fa:23:12:21:b1"

Is there a way to check if the Value after "Client Address" is already extracted into a field? It would be sort of a reverse search like "Tell me which fields has the value ee:fa:23:12:21:b1".

Thanks for your help,
Felix

0 Karma
1 Solution

SplunkTrust
SplunkTrust

I don't think the basic SPL can do that - however, you can write your own Python command that iterates over all fields looking for some value.

View solution in original post

SplunkTrust
SplunkTrust

I don't think the basic SPL can do that - however, you can write your own Python command that iterates over all fields looking for some value.

View solution in original post

Path Finder

Works like a flaw! Thanks a lot!

0 Karma

Path Finder

Ill try it out. Would be great if it works.

The performance isn't of any issue, it would be more then enough if we use it on only one event (... | head 1 | ...).

0 Karma

SplunkTrust
SplunkTrust

Giving this a bit more thought, there is a way to achieve this using basic SPL:

index=_internal | stats values(*) | transpose | rename "row 1" as values | search values=*23*

However, this is very inefficient and does not work for any reasonably large set of data. On my laptop with no real amount of data, this breaks for the _internal index even when using only the last 15 minutes.

Path Finder

Thanks for your answer.

I couldn't find a way by my own, but maybe someone will come up with something. It can be really hard to check if a given value is already extracted if there are like 80+ fields extracted.

If there is no solution it could be worth trying to write something by my own.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!